Advertisement

05.29.2008 at 07:08PM PDT, ID: 23443459
[x]
Attachment Details

VPN on PIX Firewall not able to access local resources

Asked by ironcladsecure in IPSec Security Protocol, Cisco PIX Firewall

Tags: Cisco, PIX Firewall, 501

We are trying to access a remote server via VPN through the PIX 501 firewall at the remote site. After configuring the settings using the VPN Wizard, we are able to connect to the VPN using the Cisco VPN client, but cannot ping or access resources of the remote network.

Attached is the firewall configuration....Start Free Trial 
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:

PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password lI17ZPR/Fw.rTz2C encrypted
passwd lI17ZPR/Fw.rTz2C encrypted
hostname pixfirewall
domain-name x.x.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_access_in permit tcp any any eq ftp-data 
access-list outside_access_in permit tcp any any eq ftp 
access-list outside_access_in permit tcp any any eq ssh 
access-list outside_access_in permit tcp any any eq 42 
access-list outside_access_in permit udp any any eq nameserver 
access-list outside_access_in permit tcp any any eq domain 
access-list outside_access_in permit udp any any eq domain 
access-list outside_access_in permit tcp any any eq www 
access-list outside_access_in permit tcp any any eq pop3 
access-list outside_access_in permit tcp any any eq https 
access-list outside_access_in permit tcp any any eq 465 
access-list outside_access_in permit tcp any any eq 587 
access-list outside_access_in permit tcp any any eq 995 
access-list outside_access_in permit tcp any any eq 993 
access-list outside_access_in permit tcp any any eq 3389 
access-list outside_access_in permit tcp any any eq 8443 
access-list outside_access_in permit tcp any any eq 9999 
access-list outside_access_in permit tcp any any eq 2086 
access-list outside_access_in permit tcp any any eq 2087 
access-list outside_access_in permit tcp any any eq 2082 
access-list outside_access_in permit tcp any any eq 2083 
access-list outside_access_in permit tcp any any eq 2096 
access-list outside_access_in permit tcp any any eq 2095 
access-list outside_access_in deny tcp any any eq telnet 
access-list outside_access_in permit tcp any any eq smtp 
access-list outside_access_in deny tcp any any eq imap4 
access-list outside_access_in deny tcp any any eq 1433 
access-list outside_access_in deny tcp any any eq 3306 
access-list outside_access_in deny tcp any any eq 9080 
access-list outside_access_in deny tcp any any eq 9090 
access-list outside_access_in permit icmp any any echo-reply 
access-list outside_access_in permit icmp any any source-quench 
access-list outside_access_in permit icmp any any unreachable 
access-list outside_access_in permit icmp any any time-exceeded 
access-list IroncladVPN_splitTunnelAcl permit ip any any 
access-list inside_outbound_nat0_acl permit ip any 10.0.1.0 255.255.255.0 
access-list outside_cryptomap_dyn_20 permit ip any 10.0.1.0 255.255.255.0 
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside 68.178.x.x 255.255.255.0
ip address inside 10.0.0.254 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool 10.0.1.0 10.0.1.0-10.0.1.254
pdm location 10.0.0.1 255.255.255.255 inside
pdm location 68.178.x.x 255.255.255.255 outside
pdm location 208.109.96.4 255.255.255.255 outside
pdm location 208.109.188.4 255.255.255.255 outside
pdm location 216.69.160.4 255.255.255.255 outside
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
static (outside,inside) 10.0.0.1 68.178.x.x netmask 255.255.255.255 0 0 
static (inside,outside) 68.178.x.x 10.0.0.1 netmask 255.255.255.255 0 0 
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 68.178.x.x 1
route outside 208.109.96.4 255.255.255.255 68.178.x.x 1
route outside 208.109.188.4 255.255.255.255 68.178.x.x 1
route outside 216.69.160.4 255.255.255.255 68.178.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 outside
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL 
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup IroncladVPN address-pool 10.0.1.0
vpngroup IroncladVPN dns-server 216.69.170.1 216.69.170.2
vpngroup IroncladVPN default-domain x.com
vpngroup IroncladVPN split-tunnel IroncladVPN_splitTunnelAcl
vpngroup IroncladVPN idle-time 1800
vpngroup IroncladVPN password ********
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
management-access outside
console timeout 0
username ggg password ggg/mO encrypted privilege 15
terminal width 511
Cryptochecksum:3a76fd3c0a4438b69caadedd22c389a3
[+][-]05.29.2008 at 07:27PM PDT, ID: 21674819

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.29.2008 at 07:28PM PDT, ID: 21674826

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.29.2008 at 07:28PM PDT, ID: 21674832

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.29.2008 at 07:45PM PDT, ID: 21674895

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.29.2008 at 07:58PM PDT, ID: 21674948

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.30.2008 at 04:59AM PDT, ID: 21676884

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.01.2008 at 04:55PM PDT, ID: 21688824

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06.11.2008 at 08:50AM PDT, ID: 21761344

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.11.2008 at 05:15PM PDT, ID: 21765193

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06.11.2008 at 05:34PM PDT, ID: 21765275

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: IPSec Security Protocol, Cisco PIX Firewall
Tags: Cisco, PIX Firewall, 501
Sign Up Now!
Solution Provided By: ironcladsecure
Participating Experts: 1
Solution Grade: A
 
 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628